Exploitation Research Plan - CVE-2026-32545

1. Vulnerability Summary

The Taboola Pixel plugin for WordPress (versions <= 1.1.4) contains a reflected Cross-Site Scripting (XSS) vulnerability. The flaw exists in the standalone HTML file assets/loading.html. This file contains JavaScript logic designed to redirect users to a URL provided via a query parameter. However, the script fails to sanitize the input or validate the protocol of the redirect URL before assigning it to window.location.href. An attacker can provide a javascript: URI, which the browser will execute in the context of the WordPress site's origin.

2. Attack Vector Analysis

• Vulnerable Endpoint: /wp-content/plugins/taboola-pixel/assets/loading.html
• Vulnerable Parameter: url (GET parameter)
• Authentication Required: None (Unauthenticated)
• Preconditions: The plugin must be installed and the assets/loading.html file must be accessible (standard for WordPress plugin directories).
• Payload Type: javascript: protocol handler.

3. Code Flow

1. A user (or victim) navigates to: [target]/wp-content/plugins/taboola-pixel/assets/loading.html?url=[payload]
2. The browser loads assets/loading.html and executes the embedded script.
3. The script calls getParameterByName('url').
4. Inside getParameterByName:
   • It retrieves the query string using window.location.href.
   • A regular expression /[?&]url(=([^&#]*)|&|#|$)/ extracts the value of the url parameter.
   • The value is passed through decodeURIComponent().
5. Back in the main script block, the variable redirectUrl now holds the decoded attacker input.
6. The script checks if (redirectUrl).
7. If true, a setTimeout is triggered to execute window.location.href = redirectUrl; after 100ms.
8. If redirectUrl is a javascript: string, the browser interprets this as a command to execute script in the current window's context.

4. Nonce Acquisition Strategy

No nonce is required.
The vulnerability is located in a static HTML file (assets/loading.html) that executes entirely on the client side using JavaScript. It does not interact with the WordPress PHP backend, admin-ajax.php, or the REST API for its primary execution logic, thus bypassing all WordPress server-side security controls like nonces or capability checks.

5. Exploitation Strategy

The goal is to demonstrate script execution in the context of the WordPress site.

Step-by-Step Plan:

1. Construct Payload: Create a simple payload to prove execution, such as javascript:alert(document.domain).
2. URL Encoding: The payload must be URL-encoded to ensure it passes through the getParameterByName regex correctly.
   • javascript:alert(document.domain) -> javascript%3Aalert(document.domain)
3. Execute Request: Use the browser_navigate tool to visit the vulnerable page with the payload.
4. Confirm Execution: Use browser_eval to check if a specific side-effect occurred or simply observe the page behavior.

Target URL:

GET /wp-content/plugins/taboola-pixel/assets/loading.html?url=javascript:console.log('XSS_SUCCESS_'+document.domain)

6. Test Data Setup

1. Plugin Installation: Ensure the taboola-pixel plugin (v1.1.4) is installed and activated.
2. File Verification: Verify the file exists at the expected path:

   wp eval "echo file_exists(WP_PLUGIN_DIR . '/taboola-pixel/assets/loading.html') ? 'exists' : 'missing';"
   

7. Expected Results

• The browser will navigate to the loading.html page.
• After 100ms, the setTimeout callback will execute.
• The window.location.href assignment will trigger the javascript: payload.
• The console will display XSS_SUCCESS_[site_domain].

8. Verification Steps

1. Browser Log Check: After navigating to the URL, use the browser tool to inspect console logs for the string XSS_SUCCESS_.
2. Manual Confirmation: If using an interactive browser, an alert box should appear showing the site's domain.

9. Alternative Approaches

• Cookie Exfiltration: If the site does not use HttpOnly for all cookies, attempt to log the cookies:
  • url=javascript:console.log(document.cookie)
• Bypassing Basic Filters: If a simple javascript: is blocked by a browser-level filter (unlikely for this specific sink), try:
  • url=javascript://%0Aalert(1) (Using a comment and newline)
  • url=JaVaScRiPt:alert(1) (Case sensitivity test)
• Redirection to Malicious Site: To demonstrate the "Reflected" nature and redirect impact:
  • url=https://attacker.com/malware.html (Phishing vector)